Impacket

Machine #72 on the Lain Kusanagi list. Every step in this box is intentional - no guesswork, just clean AD attack chaining from zero creds to domain admin. One of the better Hard-rated machines for learning the full lifecycle. Machine Info Name Blackfield Platform HackTheBox OS Windows Difficulty Hard IP 10.129.229.17 Domain BLACKFIELD.local TL;DR RID brute via null session gets a user list. ASREPRoast support, crack the hash, collect BloodHound data as support. BloodHound shows support can ForceChangePassword on audit2020. Change the password, enumerate SMB - forensic share has an lsass.zip in memory_analysis. pypykatz extracts svc_backup’s NT hash. PTH as svc_backup into WinRM - SeBackupPrivilege is enabled. Try SAM dump first (admin hash is stale). Use wbadmin to back up and restore ntds.dit, dump it with secretsdump, get the real admin hash, PTH to root. ...

Sauna is an Easy Windows box from HackTheBox built around a classic Active Directory attack chain. From open-source name enumeration to ASREPRoasting, autologon credential exposure, and a DCSync to finish it off - this one hits all the fundamentals. Machine Info Name Sauna Platform HackTheBox OS Windows Difficulty Easy IP 10.129.95.180 TL;DR Scraped employee names off the bank’s “About” page, ran them through username-anarchy to generate AD-style usernames, and ASREPRoasted fsmith whose account had Kerberos pre-auth disabled. Cracked the hash with rockyou.txt and logged in via WinRM. Found autologon credentials for svc_loanmanager stored in plaintext in the registry. BloodHound showed that account has DCSync rights over the domain - used secretsdump to pull the Administrator hash and psexec to get SYSTEM. ...

Forest is one of those boxes that feels like a guided tour through Active Directory attack fundamentals. No CVEs, no fancy exploits - just proper AD enumeration, a misconfigured service account, and a BloodHound-mapped path straight to domain admin. Machine Info Field Details Name Forest Platform HackTheBox OS Windows Difficulty Easy IP 10.129.5.64 TL;DR SMB user enumeration reveals a service account with no Kerberos pre-auth required. AS-REP roasting gives us a crackable hash. Shell as svc-alfresco via WinRM. BloodHound maps a path through Exchange groups giving WriteDacl on the domain. We abuse that to grant DCSync, dump the Administrator hash, and psexec our way to SYSTEM. ...

Machine Info Field Value Name Escape Platform HackTheBox OS Windows Difficulty Medium IP 10.129.228.253 TL;DR An unauthenticated SMB Public share exposes a PDF that contains SQL Server credentials. Connecting to MSSQL with those creds, we abuse xp_dirtree to capture the NTLMv2 hash of sql_svc via Responder and crack it with John. From there, SQL Server error logs left cleartext credentials for Ryan.Cooper lying around. As Ryan, certipy reveals an ESC1-vulnerable certificate template that allows anyone in Domain Users to request a cert on behalf of Administrator. One certificate later, we get the Administrator NT hash and land a SYSTEM shell via psexec. ...

GPP credentials. Still out there in the wild. Active is one of those machines that aged into a legend - the technique it teaches was patched in 2014, but the lesson sticks forever. Classic AD box, clean attack path, zero fluff. Machine info Name Active Platform HackTheBox OS Windows Difficulty Easy TL;DR Anonymous SMB access exposes the Replication share, which contains a Groups.xml file with a GPP-encrypted password for SVC_TGS gpp-decrypt recovers the plaintext: GPPstillStandingStrong2k18 Authenticated as SVC_TGS, the Users share is readable - user flag sitting in SVC_TGS\Desktop Kerberoasting as SVC_TGS returns an Administrator TGS ticket; John cracks it to Ticketmaster1968 impacket-psexec with Administrator creds gives a SYSTEM shell Recon Port scan The scan reveals a textbook Domain Controller fingerprint - DNS on 53, RPC on 135 and 593, SMB on 445, LDAP Global Catalog on 3269, Active Directory Web Services on 9389, and a pile of dynamic RPC ports in the high range. ...